CVE-2026-97720

Executive Summary

CVE-2026-97720 is an authentication bypass in Apache Impala executors (versions up to and including 4.5.2) caused by improper validation of JWT/OAuth bearer token signatures. When an Impala executor webserver is configured to accept JWT/OAuth tokens, any structurally valid JWT is accepted regardless of whether its signature was ever verified, allowing unauthenticated attackers to access resources served by the executor webserver. Organizations running Impala with JWT/OAuth enabled on executor webservers should treat this as a high-severity exposure and either disable JWT/OAuth for executors or upgrade to 4.5.3.

Technical Analysis

The vulnerability is classified under CWE-303 (Incorrect Implementation of Authentication Algorithm). In effect, the Impala executor webserver performs authentication using JWT/OAuth bearer tokens but does not validate the cryptographic signature of the presented JWT. A correct JWT verification implementation must, at minimum, recompute the signature over the header and payload using the trusted key material and reject tokens whose signatures do not match, as well as reject tokens with unsupported or "none" algorithms. The described defect indicates this verification step is missing or incorrectly implemented for the executor webserver authentication path. The practical consequence is that the webserver accepts "any valid JWT" — that is, any token that is well-formed and otherwise structurally acceptable — without establishing that it was issued by a trusted authority or that it has not been tampered with.

This is an authentication/authorization bypass rather than memory corruption or remote code execution. The attack surface is the executor webserver's token-protected HTTP resources, which are reachable over the network when JWT/OAuth authentication is enabled for executors. The flaw does not require credentials, user interaction, or a privileged network position: an attacker who can reach the executor webserver and craft a syntactically valid JWT can present it as a bearer token and have it accepted. Because signature verification is the integrity guarantee of a JWT, its absence means both the token's claims (identity, roles, scopes) and its origin are untrusted, yet they are treated as authenticated.

No public proof-of-concept, Nuclei template, or exploit code was identified in the provided intelligence, and no CVSS base score or vector was assigned by NVD. The technical mechanism above is derived strictly from the NVD description; no specific internal function names, endpoints, or parameter names beyond "JWT/OAuth", "bearer token", and "executor webserver" are asserted here, as none were provided.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (authentication bypass via unverified JWT signature) and the NVD description.

1. Reconnaissance / target identification: The attacker identifies Apache Impala deployments and determines whether executor webservers are configured to accept JWT/OAuth tokens. This may be inferred from service banners or by observing that token-protected executor endpoints exist. Reconnaissance is limited to hosts reachable on the network path to the executor webserver.

2. Triggering the flaw: The attacker obtains or forges a JWT — for example, a token with attacker-controlled claims, a token signed with an untrusted or unknown key, or a token using a mismatched/unexpected signing algorithm. Because the executor webserver does not validate the signature, a structurally valid token is accepted regardless of whether its signature can be verified. No secret key material is required, since verification is not performed.

3. Payload / execution method (vulnerability-class level): The attacker presents the crafted JWT as a bearer token in an authenticated request to the executor webserver. The request is treated as authenticated and is served, bypassing the intended JWT/OAuth access control. No specific endpoints, headers beyond the bearer-token concept, or parameter names are provided in the source data, and none are invented here.

4. Post-exploitation impact: The attacker gains access to resources served by the executor's webserver that are intended to be protected by JWT/OAuth authentication. The scope of impact is bounded by what those executor webserver resources expose. Because claim validation is effectively meaningless when signatures are not checked, any access decisions derived from token claims (identity, roles, scopes) are unreliable.

Impact Assessment

This is a network-reachable authentication bypass (AV:N) with low attack complexity (AC:L) and no privileges or user interaction required (PR:N, UI:N), consistent with the inferred CVSS:3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The primary impact is to confidentiality (C:H): unauthorized parties can reach resources served by Impala executor webservers when JWT/OAuth is enabled. No NVD-assigned CVSS score was provided, and none should be assumed from third-party sources; the vector above is an inferred assessment and should be validated against the vendor's final scoring.

Blast radius is limited to environments where all three conditions hold: (a) Apache Impala up to and including 4.5.2, (b) JWT/OAuth authentication enabled for executors, and (c) executor webservers reachable by untrusted clients. In such environments, the authentication boundary protecting executor webserver resources is effectively absent, so any party with network access to those resources can attempt access. Environments that have disabled JWT/OAuth for executors, or that strictly segment executor webservers from untrusted networks, are substantially less exposed.

Detection Guidance

Sigma Rule

title: Apache Impala Executor JWT/OAuth Authentication Bypass Attempt
id: 7f2c9a44-impala-jwt-bypass-2026
status: experimental
description: Detects access to Impala executor webserver resources using JWT/OAuth bearer tokens where signature validation is absent (CVE-2026-97720)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97720
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_token:
    cs-headers|contains:
      - 'Authorization: Bearer eyJ'
      - 'authorization: bearer eyj'
  selection_impala:
    cs-uri-stem|contains:
      - 'impala'
  condition: selection_method and selection_token and selection_impala
falsepositives:
  - Legitimate authenticated operator traffic using valid JWT/OAuth tokens
level: medium
tags:
  - attack.t1190
  - cve.2026.97720

YARA Rule

rule CVE_2026_97720_Impala_JWT_Bypass
{
    meta:
        description = "Detects JWT bearer tokens and Impala executor references associated with CVE-2026-97720 authentication bypass"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97720"
        cve = "CVE-2026-97720"
    strings:
        $jwt_hdr = "eyJhbGciOi" ascii
        $bearer  = "Bearer " ascii nocase
        $impala  = "impala" ascii nocase
        $executor = "executor" ascii nocase
    condition:
        uint16(0) == 0x4854 or
        (any of ($bearer, $jwt_hdr) and any of ($impala, $executor))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97720 Apache Impala Executor JWT/OAuth Authentication Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.header; content:"Authorization"; nocase; http.header; content:"Bearer "; nocase; http.header; content:"eyJ"; nocase; http.uri; content:"impala"; nocase; reference:cve,2026-97720; classtype:attempted-admin; sid:202697720; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where network.protocol == "http" and http.request.method in ("GET","POST")]
  [network where network.protocol == "http" and
     http.request.headers.authorization : "Bearer *" and
     url.path : "*impala*"]

Splunk SPL Query

index=web OR index=proxy
| search (cs_headers="*Authorization*Bearer*" OR http_authorization="*Bearer*")
| search (uri="*impala*" OR cs_uri_stem="*impala*" OR dest="*impala*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as uris values(src_ip) as src_ips by dest, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="apache,impala,web,">
  <rule id="100977" level="10">
    <if_sid>31100</if_sid>
    <match>impala</match>
    <regex>Authorization:\s*Bearer\s+eyJ</regex>
    <description>CVE-2026-97720: Possible Apache Impala executor JWT/OAuth authentication bypass attempt (bearer token to impersonate authenticated access)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Disable JWT/OAuth authentication for Impala executors where it is not strictly required. The vendor explicitly recommends this as an interim measure, since the flaw only manifests when the executor webserver is configured to accept JWT/OAuth tokens.
• Network-segment and firewall executor webservers so that only trusted management/operator networks can reach them; do not expose them to untrusted clients.
• Audit recent access logs to executor webserver resources for requests bearing bearer tokens (JWT) originating from unexpected sources, and review for indicators of unauthorized access.

2. Patch / upgrade steps

• Upgrade to Apache Impala 4.5.3, which the vendor states fixes this issue. Because patch confidence is 0/4 and no patch artifacts were independently verified in the provided sources, validate the fix against the vendor's official release notes and advisory before relying on it, and confirm that the executor webserver now enforces JWT signature validation after upgrade.
• If upgrade cannot be performed immediately, keep JWT/OAuth disabled for executors until the upgrade is complete.

3. Long-term hardening

• Treat authentication libraries as security-critical: enforce signature verification, reject unsupported signing algorithms, and pin the set of accepted issuers and algorithms for any JWT/OAuth implementation.
• Add automated tests that specifically verify rejection of unsigned, tampered, or wrong-algorithm tokens.
• Restrict network exposure of management and executor webservers; apply least-privilege network policy and continuous monitoring.
• Track the CVE for a vendor-assigned CVSS score, formal advisory, and any future patch references, as none were available at the time of this report.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97720
• Apache Impala project / security advisories (Apache Software Foundation) — consult for the official fix and 4.5.3 release notes.
• CWE-303: Incorrect Implementation of Authentication Algorithm — https://cwe.mitre.org/data/definitions/303.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities catalog — not listed (no exploit-in-the-wild evidence provided). No known threat actor campaigns or public PoC were identified in the supplied intelligence.